Defender's Corner

Microsoft has removed WMIC (Windows Management Instrumentation Command-line) from Windows 11 versions 24H2 and 25H2, according to Bleeping Computer. WMIC is a built-in Windows utility that attackers have long repurposed to delete backups, disable antivirus software, and dig deeper into compromised systems — all without triggering alerts, because the tool was signed by Microsoft itself.

Its removal means a whole category of well-established attack techniques simply stops working on updated systems.

What to do: Open Windows Update and make sure you are running the latest version of Windows 11. If you manage Windows machines for a small business, check that automatic updates are enabled across all devices. This one costs nothing and closes real doors.

GitHub's Dependabot is a built-in tool that automatically scans your code's dependencies (the third-party packages your project relies on) and alerts you when something dangerous turns up.

Until this month, Dependabot's malware alerts only covered npm, one of the most popular package registries. That meant poisoned packages from PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer went undetected. As reported by Help Net Security, all eight ecosystems are now covered.

If you manage any GitHub repository, enable Dependabot malware alerts now. Go to your repository, click Settings → Security & analysis → Dependabot alerts, and switch it on. It is free, takes thirty seconds, and runs across more than 30 million repositories already.

The macOS Screen Sharing vulnerability being actively exploited right now is a good reminder that built-in remote access features are a liability when left on by default. Screen Sharing, Apple's remote desktop tool, only needs to be reachable from the internet to become a target — and many users have no idea it's enabled.

Disabling it takes thirty seconds. On your Mac, open System Settings → General → Sharing, find Screen Sharing, and switch it off. If you do need remote access to your Mac, consider using it only over a VPN rather than exposing port 5900 directly to the internet.

More broadly, go through everything listed under Sharing in System Settings. Remote Login, Remote Management, and AirPlay Receiver are all features worth disabling if you don't actively use them.

WhatsApp is rolling out a new feature called Scam Alert, according to Bleeping Computer. It runs a machine learning model directly on your device to flag messages from unknown contacts that match known scam patterns.

Nothing leaves your phone for analysis. No message content is sent to WhatsApp, Meta, or anyone else. If the model spots something suspicious, you will see a prompt to block, report, or continue. If it gets it wrong, you can mark the chat as trusted.

The feature is in limited beta right now but is expected to roll out more broadly. To check if it is available: open WhatsApp, go to Settings → Privacy and look for Scam Alert. Enable it if you see it.

Scam messages via messaging apps are one of the most common ways people are defrauded. This is a free, privacy-respecting layer of protection that takes thirty seconds to enable.

Signal has launched Automatic Key Verification, a new feature described by Bleeping Computer that protects against man-in-the-middle attacks (where someone intercepts your messages by quietly swapping out your contact's encryption key for their own). Previously, confirming a contact's key required meeting in person or using a separate channel. Now Signal uses Cloudflare and Trail of Bits as independent auditors to verify that the key associated with a phone number has not been tampered with.

To enable it: open Signal, go to Settings > Privacy > Advanced, and toggle on Automatic Key Verification. A green "Encryption verified" badge will appear when a chat is confirmed clean.

This matters because Russian state-sponsored hackers previously compromised Signal accounts by abusing the Linked Devices feature. This feature closes a gap they exploited.

Google announced that Chrome's anti-abuse systems blocked over 7 billion unwanted Android notifications per day in Q1 2026, according to Bleeping Computer.

Notification abuse is a real attack channel: scammers use browser notifications to deliver phishing links and fraudulent payment requests. Chrome now automatically revokes notification permissions from inactive or suspicious sites and lets you review what it has removed.

What to do right now: On Android, open Chrome and go to Settings > Notifications. On desktop, go to Settings > Privacy and security > Site Settings > Notifications. Review which sites have permission to send you notifications and revoke anything you do not recognise. Chrome's Safety Hub will also show you permissions it has already revoked automatically — check that list too. If a site you removed turns out to be legitimate, you can restore it.

This takes about two minutes and cuts a surprisingly effective scam delivery channel off at the source.

If you or your team write Python code, your encryption just got a significant upgrade available with a single install. The pyca/cryptography library now includes support for ML-KEM and ML-DSA, the two post-quantum cryptography standards finalised by NIST (the US National Institute of Standards and Technology). Post-quantum cryptography refers to encryption algorithms designed to resist attacks from quantum computers, which are expected to eventually break most encryption in use today.

You do not need a quantum computer bearing down on you to act. The point of switching now, as the project puts it, is precisely that there is no emergency yet — which means time to migrate carefully rather than frantically.

To get it: pip install cryptography (version 44 or later).

If you are not a developer, ask whoever manages your software stack whether your tools are on the roadmap for post-quantum upgrades.

GitHub's Dependabot is a built-in tool that automatically scans your project's dependencies — the third-party packages your code relies on — and alerts you when something is outdated or dangerous. Until now, its malware detection only covered npm (a package registry for JavaScript developers). That changed this month, according to Help Net Security.

Dependabot now draws from OpenSSF's malicious-packages database, a public feed covering eight ecosystems including PyPI (Python), Maven (Java), RubyGems, NuGet (.NET), Go, crates.io (Rust), and PHP Composer.

If you use GitHub for any development work, enabling Dependabot malware alerts takes one minute and adds an automatic watchdog across your entire dependency chain.

What you should do: Go to your GitHub repository or organisation settings, find the Security section, and enable Dependabot malware alerts. It is free and takes effect immediately.

The RovoBlast finding, presented at DEF CON 34, illustrates a risk that applies well beyond Atlassian: AI assistants with broad integration access can be weaponised to exfiltrate data automatically once an attacker controls their input.

Varonis researchers recommend a concrete set of steps that any team using an enterprise AI tool can apply right now, according to SecurityWeek:

1. Audit which systems your AI assistant can access and remove any integrations not actively used.
2. Block AI access to sensitive departments — HR, legal, and finance — unless there is a specific, reviewed business need.
3. Disable autonomous browsing or multi-step agent features if your team does not rely on them daily.
4. Enable activity logging for your AI assistant and review it regularly for unusual data access patterns.

Think of it like giving a new intern a master keycard on day one — useful in theory, but you would probably hand them the specific keys they actually need instead.

The Swiss government breach is a useful reminder: it is not just about patching. It is about knowing what is exposed in the first place.

Microsoft SharePoint — the document storage and collaboration platform used by thousands of organisations — often ends up with external internet access enabled by default, even when that access is not needed. That is unnecessary attack surface.

Do this today:

1. Open your Microsoft 365 admin centre and check SharePoint's external sharing settings under Policies → Sharing
2. If external sharing is not required for your team, set it to "Only people in your organisation"
3. Confirm your July 2026 SharePoint patches are applied via Microsoft 365 admin → Health → Message Centre

Takes under 10 minutes and meaningfully reduces your exposure.

SharePoint admin sharing settings — Microsoft Docs